[Snort-users] Another question

Tommy Tsilalis Thomas.Tsilalis at ...5827...
Sat May 11 20:07:29 EDT 2002

This is another Snort output.

[**] [100:1:1] spp_portscan: PORTSCAN DETECTED from (THRESHOLD 4
connections exceeded in 0 seconds) [**]

I suppose that spp_portscan is the Snort function which identifies or checks
for portscans.
What does the following mean?

Thanks again.

Thomas Tsilalis

More information about the Snort-users mailing list